What happened
The Google ADK Python FileArtifactService constructs paths as root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/..., exposing resources to the wrong sphere (CWE-668). A partial scoping change in 2.6.0 left a legacy fallback for reads/deletes until 2.7.0/1.39.1 closed it.
Why it matters
Agent artifacts often carry sensitive state, credentials, or intermediate reasoning. A cross-application artifact access flaw means one agent/application can read or overwrite another's artifacts in shared agent hosts, enabling tampering with another agent's state.
Attack vector
FileArtifactService accepted app_name across its public API methods but omitted it when building on-disk paths, so a caller in one application can list, read, overwrite, or delete artifacts belonging to another application that shares the root directory and the same user_id/session_id.
Affected systems
google-adk >= 1.19.0, < 1.39.1 and >= 2.0.0a1, < 2.7.0
Mitigation
Upgrade to google-adk 1.39.1 (1.x backport) or 2.7.0, which enforce per-app path scoping and remove the legacy root/users/{user_id} fallback.